[AutoPR- Security] Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874 [HIGH]

SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec

@@ -11,7 +11,7 @@
 Summary:        Signed HvLoader.efi for %{buildarch} systems
 Name:           edk2-hvloader-signed-%{buildarch}
 Version:        %{GITDATE}git%{GITCOMMIT}
-Release:        18%{?dist}
+Release:        19%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -74,6 +74,9 @@ popd
 /boot/efi/HvLoader.efi
 
 %changelog
+* Thu Aug 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-19
+- Bump release for consistency with edk2 spec.
+
 * Tue Jun 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-18
 - Bump release for consistency with edk2 spec.
 

SPECS/edk2/CVE-2026-63072.patch

@@ -0,0 +1,51 @@
+From 2e2af3344548d38b48f88371270ef8d68ae87d5b Mon Sep 17 00:00:00 2001
+From: Daniel Kubec <kubec@openssl.foundation>
+Date: Sun, 2 Aug 2026 00:23:39 +0000
+Subject: [PATCH] Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD
+ unwrap
+
+On its integrity-failure paths that primitive writes and cleanses up to inlen
+bytes of the output buffer. Size the buffer for that worst case so a failed
+unwrap cannot write past the allocation.
+
+Fixes CVE-2026-63072
+
+Reviewed-by: Milan Broz <mbroz@openssl.org>
+Reviewed-by: Andrew Dinh <andrewd@openssl.org>
+Merge-date: Mon Aug 24 14:44:55 2026
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382.patch
+---
+ .../Library/OpensslLib/openssl/crypto/cms/cms_kari.c     | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_kari.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_kari.c
+index a2f422a..47e50d8 100644
+--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_kari.c
++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_kari.c
+@@ -217,6 +217,7 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
+     int rv = 0;
+     unsigned char *out = NULL;
+     int outlen;
++    size_t outsize;
+
+     keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
+     if (keklen > EVP_MAX_KEY_LENGTH)
+@@ -230,7 +231,13 @@ static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
+     /* obtain output length of ciphered key */
+     if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
+         goto err;
+-    out = OPENSSL_malloc(outlen);
++    /*
++     * On its integrity-failure paths that primitive writes and cleanses up to
++     * inlen bytes of the output buffer. Size the buffer for that worst case so
++     * a failed unwrap cannot write past the allocation.
++     */
++    outsize = (size_t)outlen < inlen ? inlen : (size_t)outlen;
++    out = OPENSSL_malloc(outsize);
+     if (out == NULL)
+         goto err;
+     if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, inlen))
+-- 
+2.45.4
+

SPECS/edk2/CVE-2026-63074.patch

@@ -0,0 +1,84 @@
+From 10a51aea3c14ebb36267b5ad0b89b4cfc7c7e44a Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@openssl.org>
+Date: Tue, 30 Jun 2026 15:09:01 -0400
+Subject: [PATCH] Fix unbounded cert cache growth in cmp
+
+If a remote user sends cmp messages to a server with a list of
+extraCerts and the message is rejected, the extraCerts from the message
+remain in the server contexts untrusted certificate stack.  This exposes
+servers with long lived ctx objects to denial of service attacks in
+which an attacker sends messages intending to be rejected with a large
+list of additional cerificated repeatedly, forcing the server to store
+them indefinately.
+
+Fix it by rolling back the added extra certs if the message is rejected,
+using the same method we do when the context is configured to not do
+caching at all.
+
+Fixes openssl/srt#224
+
+Fixes CVE-2026-63074
+
+Reviewed-by: Milan Broz <mbroz@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
+Reviewed-by: Igor Ustinov <igus@openssl.foundation>
+Merge-date: Mon Aug 24 12:45:55 2026
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f.patch
+---
+ .../OpensslLib/openssl/crypto/cmp/cmp_vfy.c       | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_vfy.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_vfy.c
+index b9d6fc2..6c246db 100644
+--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_vfy.c
++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_vfy.c
+@@ -666,6 +666,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
+ {
+     OSSL_CMP_PKIHEADER *hdr;
+     const X509_NAME *expected_sender;
++    int num_extra_before, num_extra_after, num_added;
+
+     if (!ossl_assert(ctx != NULL && msg != NULL && msg->header != NULL))
+         return 0;
+@@ -700,17 +701,27 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
+      * extraCerts because they do not belong to the protected msg part anyway.
+      * For efficiency, the extraCerts are prepended so they get used first.
+      */
++    num_extra_before = sk_X509_num(ctx->untrusted);
+     if (!X509_add_certs(ctx->untrusted, msg->extraCerts,
+                         /* this allows self-signed certs */
+                         X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
+                         | X509_ADD_FLAG_PREPEND))
+         return 0;
+-
++    num_extra_after = sk_X509_num(ctx->untrusted);
++    num_added = num_extra_after - num_extra_before;
+     /* validate message protection */
+     if (hdr->protectionAlg != NULL) {
+         /* detect explicitly permitted exceptions for invalid protection */
+         if (!OSSL_CMP_validate_msg(ctx, msg)
+                 && (cb == NULL || (*cb)(ctx, msg, 1, cb_arg) <= 0)) {
++            /*
++             * remove extraCerts again if not caching
++             * or if we failed validation above, lest a remote user
++             * starts sending us lots of certificate in invalid messages
++             * leading to a DOS from unbounded certificate stack growth
++             */
++            while (num_added-- > 0)
++                X509_free(sk_X509_shift(ctx->untrusted));
+ #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+             ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_VALIDATING_PROTECTION);
+             return 0;
+@@ -719,6 +730,8 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
+     } else {
+         /* detect explicitly permitted exceptions for missing protection */
+         if (cb == NULL || (*cb)(ctx, msg, 0, cb_arg) <= 0) {
++            while (num_added-- > 0)
++                X509_free(sk_X509_shift(ctx->untrusted));
+ #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+             ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PROTECTION);
+             return 0;
+-- 
+2.45.4
+

SPECS/edk2/CVE-2026-63076.patch

@@ -0,0 +1,42 @@
+From a03b98db440eb09cd61c29f1072ecf861ed9518d Mon Sep 17 00:00:00 2001
+From: Daniel Kubec <kubec@openssl.foundation>
+Date: Tue, 21 Jul 2026 11:19:29 +0200
+Subject: [PATCH] Fix Remote NULL deref in ossl_cmp_calc_protection() via
+ crafted protectionAlg
+
+ossl_cmp_calc_protection() only checked whether the protectionAlg parameter
+(ppval) was NULL before treating it as a PBMParameter ASN1_STRING.
+
+X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what
+the caller expects. For id-PasswordBasedMAC, a crafted message can encode the
+parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because
+the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval
+comes back as a bogus non-NULL pointer (e.g. 0xff).
+
+Fixes CVE-2026-63076
+
+Reviewed-by: Milan Broz <mbroz@openssl.org>
+Reviewed-by: Norbert Pocs <norbertp@openssl.org>
+Merge-date: Sat Aug 22 06:12:04 2026
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b.patch
+---
+ CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_protect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_protect.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_protect.c
+index 0252619..bf24a8e 100644
+--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_protect.c
++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/cmp/cmp_protect.c
+@@ -63,7 +63,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
+             ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
+             return NULL;
+         }
+-        if (ppval == NULL) {
++        if (pptype != V_ASN1_SEQUENCE || ppval == NULL) {
+             ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
+             return NULL;
+         }
+-- 
+2.45.4
+

SPECS/edk2/CVE-2026-75803.patch

@@ -0,0 +1,92 @@
+From e5a23c6fb3ec02e5358b724c8664362c8b3e60fd Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Wed, 26 Aug 2026 21:20:27 +0000
+Subject: [PATCH] Check the tag on EVP_Cipher() finalize: Poly1305 and OCB
+ AEADs
+
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42.patch
+---
+ .../implementations/ciphers/cipher_aes_ocb.c  |  4 +++
+ .../ciphers/cipher_chacha20_poly1305.c        | 27 ++++++++++++++-----
+ 2 files changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_aes_ocb.c b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
+index 78ff071..040dcb2 100644
+--- a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
++++ b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
+@@ -502,6 +502,10 @@ static int aes_ocb_cipher(void *vctx, unsigned char *out, size_t *outl,
+     if (!ossl_prov_is_running())
+         return 0;
+
++    /* NULL input indicates Final, which must generate or check the tag. */
++    if (in == NULL)
++        return aes_ocb_block_final(vctx, out, outl, outsize);
++
+     if (outsize < inl) {
+         ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
+         return 0;
+diff --git a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
+index 0ba7483..bd7f66a 100644
+--- a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
++++ b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
++ * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
+  *
+  * Licensed under the Apache License 2.0 (the "License").  You may not use
+  * this file except in compliance with the License.  You can obtain a copy
+@@ -30,11 +30,11 @@ static OSSL_FUNC_cipher_get_params_fn chacha20_poly1305_get_params;
+ static OSSL_FUNC_cipher_get_ctx_params_fn chacha20_poly1305_get_ctx_params;
+ static OSSL_FUNC_cipher_set_ctx_params_fn chacha20_poly1305_set_ctx_params;
+ static OSSL_FUNC_cipher_cipher_fn chacha20_poly1305_cipher;
++static OSSL_FUNC_cipher_update_fn chacha20_poly1305_update;
+ static OSSL_FUNC_cipher_final_fn chacha20_poly1305_final;
+ static OSSL_FUNC_cipher_gettable_ctx_params_fn chacha20_poly1305_gettable_ctx_params;
+ #define chacha20_poly1305_settable_ctx_params ossl_cipher_aead_settable_ctx_params
+ #define chacha20_poly1305_gettable_params ossl_cipher_generic_gettable_params
+-#define chacha20_poly1305_update chacha20_poly1305_cipher
+
+ static void *chacha20_poly1305_newctx(void *provctx)
+ {
+@@ -276,11 +276,6 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out,
+     if (!ossl_prov_is_running())
+         return 0;
+
+-    if (inl == 0) {
+-        *outl = 0;
+-        return 1;
+-    }
+-
+     if (outsize < inl) {
+         ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
+         return 0;
+@@ -292,6 +287,24 @@ static int chacha20_poly1305_cipher(void *vctx, unsigned char *out,
+     return 1;
+ }
+
++static int chacha20_poly1305_update(void *vctx, unsigned char *out,
++    size_t *outl, size_t outsize,
++    const unsigned char *in, size_t inl)
++{
++    /*
++     * A zero-length update is a no-op. Only EVP_Cipher() and Final produce or
++     * check the authentication tag.
++     */
++    if (inl == 0) {
++        if (!ossl_prov_is_running())
++            return 0;
++        *outl = 0;
++        return 1;
++    }
++
++    return chacha20_poly1305_cipher(vctx, out, outl, outsize, in, inl);
++}
++
+ static int chacha20_poly1305_final(void *vctx, unsigned char *out, size_t *outl,
+                                    size_t outsize)
+ {
+-- 
+2.45.4
+

SPECS/edk2/edk2.spec

@@ -56,7 +56,7 @@ Distribution:   Azure Linux
 
 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    18%{?dist}
+Release:    19%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
 License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain
 URL:        https://www.tianocore.org
@@ -160,6 +160,10 @@ Patch1022: CVE-2026-45445.patch
 Patch1023: CVE-2026-45447.patch
 Patch1024: CVE-2026-7383.patch
 Patch1025: CVE-2026-9076.patch
+Patch1026: CVE-2026-63072.patch
+Patch1027: CVE-2026-63074.patch
+Patch1028: CVE-2026-63076.patch
+Patch1029: CVE-2026-75803.patch
 
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@@ -807,6 +811,9 @@ done
 %endif
 
 %changelog
+* Wed Aug 26 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-19
+- Patch for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072
+
 * Tue Jun 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-18
 - Patch for CVE-2026-9076, CVE-2026-7383, CVE-2026-45447, CVE-2026-45445, CVE-2026-42767, CVE-2026-42766, CVE-2026-34182, CVE-2026-34180